let
  ssh-new = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAxOg9nOtfbedq9AlnXNVUfyU8Mwfj4IB7HX/4VoWeXP";
  yubi-back = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDTVGi3PItsbUhFgnFZlqo1iUggL4npMg94+9FsyhEPfShcQwJK2/jJzjv5S9KPuk3cY7aoqyVFLbnasSBZPXmscJmOiVNvtWvHoC3QPXvf3IAcVZ5KOLpY2NJlPx/pAb31C6ewtg8v3VlyhL4zEp6M+AGwXX51tFDh2GnYD+7SNF+aMhKCrX63syAhgPy3F8mZ2RIDLAu+lsYlwdpWRkSEv9kcjX/6+3QgUWjfPBaKEeYID22ihSuj7+AiuAt0gM4q0TY/Hpcx+qDLonrIuBnm1hMZDgbv//D0sHIUxJQkGTKTEbkZxoh0Qri7UV/V6l3mETaG40deuemMU7RFY7Khl8RajNZ+9z0FdquS/HCt8+fYQk6eLneJrMIQ1bI4awrtblG3P2Yf2QUu+H3kfCQe44R3WjUugTbNtumVgyQBzl2dzlIVn1pZBeyZy70XCgbaFKkDR8Y/qZiUoZ0afP3vTOXhkn5UBfutTKwUiSGh3S8Ge5YhNgKHWE2eQp1ckEm0IMJV/q5Nsw/yBBXj/kfD8ekz96LQ+gP5JFLq4EaipXI7FM4aZNOBUZU1l/sCEuq7m997nrBucTKqGm7Ho3rq7bgdj4f6GyUJXSMOM1cN61LLrRumZGGTH8WghVL7ligxZyNFcQoudR8jfpf4mrgRxipQOe1A2umvuufMr+l/bw==";
  marvin = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP60B1IOdfJRrDcCKajMV8YJNC01gSsccZi3DKHlS6YJ";
  marvinDefault = [
    marvin
    yubi-back
    ssh-new
  ];

  # These are the private keys for the post-quantum encrypted secrets.
  # All secrets will slowly be converted to use these, but that will take time.
  # As I do so, git-filter-repo may be used to remove the old secrets from history,
  # as well as rotating the secrets as the original protection.
  zaphod-pq = builtins.readFile ./keys/zaphod-pq.pub;
  marvin-pq = builtins.readFile ./keys/marvin-pq.pub;

  pqKeys = [
    zaphod-pq
    marvin-pq
  ];
in
{
  "marvin-pq-privkey.age".publicKeys = pqKeys;

  "../nextcloud/nextcloud-admin-pw.age".publicKeys = marvinDefault;
  "anubis-key.age".publicKeys = marvinDefault;
  "golink-authkey.age".publicKeys = marvinDefault;
  "jellyfin-exporter-secrets.age".publicKeys = pqKeys;
  "mail-archiver-secrets.age".publicKeys = marvinDefault;
  "miniflux-admin.age".publicKeys = pqKeys;
  "pinchflat-secrets.age".publicKeys = pqKeys;
  "planka-env.age".publicKeys = marvinDefault;
  "pocket-id-secrets.age".publicKeys = marvinDefault;
  "tsnsrv-auth-key.age".publicKeys = pqKeys;
  "vaultwarden-vars.age".publicKeys = pqKeys;
  "voidauth-secrets.age".publicKeys = pqKeys;

  "buildbot/gitea-token.age".publicKeys = marvinDefault;
  "buildbot/oauth-secret.age".publicKeys = marvinDefault;
  "buildbot/worker-password.age".publicKeys = marvinDefault;
  "buildbot/workers.age".publicKeys = marvinDefault;

  "forgejo/aux-docs-runner-token.age".publicKeys = marvinDefault;
  "forgejo/default-runner-token.age".publicKeys = marvinDefault;
  "forgejo/gitgay-runner-token.age".publicKeys = marvinDefault;
  "forgejo/internal-token.age".publicKeys = pqKeys;
  "forgejo/lfs-jwt-secret.age".publicKeys = pqKeys;
  "forgejo/mail-pw.age".publicKeys = pqKeys;
  "forgejo/oauth2-jwt-secret.age".publicKeys = pqKeys;
  "forgejo/oidc-secret.age".publicKeys = pqKeys;
  "forgejo/secret-key.age".publicKeys = marvinDefault;

  "grafana/admin-password.age".publicKeys = marvinDefault;
  "grafana/oidc-secret.age".publicKeys = marvinDefault;
  "grafana/smtp-password.age".publicKeys = marvinDefault;
  "grafana/secret-key.age".publicKeys = marvinDefault;

  "immich/oauth-secret.age".publicKeys = marvinDefault;
  "immich/mail-pw.age".publicKeys = marvinDefault;

  "paperless/admin-password.age".publicKeys = marvinDefault;
  "paperless/secrets.age".publicKeys = marvinDefault;

  "shelfmark/secrets.age".publicKeys = pqKeys;
  "shelfmark/oidc-secret.age".publicKeys = pqKeys;
}